diff --git a/src/editfns.c b/src/editfns.c
index 93b7c405cd1..78f1b1a710a 100644
--- a/src/editfns.c
+++ b/src/editfns.c
@@ -1394,29 +1394,34 @@ Use %% to put a single % into the output.")
 
   {
     register int nstrings = n + 1;
-    register unsigned char **strings
-      = (unsigned char **) alloca (nstrings * sizeof (unsigned char *));
 
+    /* Allocate twice as many strings as we have %-escapes; floats occupy
+       two slots, and we're not sure how many of those we have.  */
+    register unsigned char **strings
+      = (unsigned char **) alloca (2 * nstrings * sizeof (unsigned char *));
+    int i;
+
+    i = 0;
     for (n = 0; n < nstrings; n++)
       {
 	if (n >= nargs)
-	  strings[n] = (unsigned char *) "";
+	  strings[i++] = (unsigned char *) "";
 	else if (XTYPE (args[n]) == Lisp_Int)
 	  /* We checked above that the corresponding format effector
 	     isn't %s, which would cause MPV.  */
-	  strings[n] = (unsigned char *) XINT (args[n]);
+	  strings[i++] = (unsigned char *) XINT (args[n]);
 #ifdef LISP_FLOAT_TYPE
 	else if (XTYPE (args[n]) == Lisp_Float)
 	  {
 	    union { double d; int half[2]; } u;
 
 	    u.d = XFLOAT (args[n])->data;
-	    strings[n++] = (unsigned char *) u.half[0];
-	    strings[n] = (unsigned char *) u.half[1];
+	    strings[i++] = (unsigned char *) u.half[0];
+	    strings[i++] = (unsigned char *) u.half[1];
 	  }
 #endif
 	else
-	  strings[n] = XSTRING (args[n])->data;
+	  strings[i++] = XSTRING (args[n])->data;
       }
 
     /* Format it in bigger and bigger buf's until it all fits. */
@@ -1425,7 +1430,7 @@ Use %% to put a single % into the output.")
 	buf = (char *) alloca (total + 1);
 	buf[total - 1] = 0;
 
-	length = doprnt (buf, total + 1, strings[0], end, nargs, strings + 1);
+	length = doprnt (buf, total + 1, strings[0], end, i-1, strings + 1);
 	if (buf[total - 1] == 0)
 	  break;